Facebook’s extensive collection of user-related data must be put on hold in Germany for the time being following a decision of Germany’s Federal Supreme Court on June 23, 2020. In summary proceedings, the Federal Supreme Court overturned an earlier order of the Higher Regional Court of Düsseldorf that – pending the outcome of an appeal by Facebook – had suspended the effect of a prohibition order issued by Germany’s Federal Cartel Office (FCO) in 2019 restricting Facebook’s collection of data. The FCO’s prohibition order will therefore be effective during Facebook’s ongoing appeal.

The case concerns the terms of use that private users of Facebook must agree to when logging-in to the social network. The terms require users to “consent” to Facebook’s use of personal data, i.e. they are compelled to agree that their personal data may be combined with their personal data from other services within Facebook’s group (e.g. WhatsApp and Instagram), as well as from third party websites. Voluntary consent for the purposes of the EU General Data Protection Regulation (GDPR) requires that the user has a genuine choice over how their personal data is used. The contention in this case is that the only real choice the user has when using Facebook is either to accept the comprehensive combining of their personal data, or to refrain from using the social network altogether. This type of ‘take it or leave it’ approach to obtaining consent is known as ‘bundling’ in the data protection sphere and is expressly prohibited by the GDPR.

After an investigation lasting approximately three years, the FCO issued a decision on February 6, 2019 prohibiting Facebook and other affiliated companies from requiring users to consent to their personal data being processed in this way. The decision also required Facebook to implement remedial measures (see our earlier briefing)

The FCO found these practices go too far and amount to an abuse of a dominant position by Facebook, in breach of German competition law. In reaching this decision, the FCO concluded its investigation ahead of any decision by Ireland’s data protection authority, which has also opened proceedings against Facebook, amongst other things, to check whether such broad consents of users are permissible under data protection laws.

At Facebook’s request, the Higher Regional Court of Düsseldorf issued an order in August 2019 suspending the effect of the FCO’s decision pending Facebook’s appeal and due to serious doubts about the legality of the FCO’s decision (see our earlier video)

). The Higher Regional Court of Düsseldorf’s decision was then itself subject to review by Germany’s Federal Supreme Court – still in the interim proceedings – and, as mentioned, was overruled on June 23.

The reasons for the FCO’s decision

The FCO based its finding of an abuse of a dominant position on a violation of legal provisions outside the realm of competition law, namely the GDPR. In early 2019, the president of the FCO, Andreas Mundt, said: “In future Facebook may no longer force its users to agree to a de-facto unlimited collection and allocation of non-Facebook data to their user account”. Instead, users would have to actively agree to Facebook merging their data with information from other platforms / sites, meaning that the company must give users a genuine choice.

Put simply, the rationale of the FCO’s decision was that a dominant company may commit an abuse of its dominant position if it violates the GDPR in this way.

At first it looked good for Facebook…

By its decision of August 26, 2019, following an appeal by Facebook, the 1st Cartel Senate of the Higher Regional Court of Düsseldorf overturned the enforcement of the FCO’s decision in summary proceedings.  It ordered that the effect of the FCO’s decision be suspended. According to the Court, the drafting of terms of use did not constitute an abuse of a dominant position for several reasons: lack of causality, no damage to competition, and incorrect remedies. The Senate stated:

“The Office’s argument that the customer is uninformed because he does not read the terms of use […] is not valid in this context because […] the failure to inform is not due to the market power of Facebook, but, if appreciated in a realistic way, is most likely due to the indifference or convenience of the Facebook user […]”

According to the Düsseldorf Cartel Senate, this cannot be used to justify harm to Facebook users in the form of loss of control over their data.

Victory of the FCO before the Federal Supreme Court

The Federal Supreme Court’s Cartel Senate has now issued its own decision that seemingly leaves no doubt about Facebook’s dominant position in the social networking market or about the abuse of that position. It overturned the decision of the Higher Regional Court of Düsseldorf and rejected Facebook’s application for suspension of the effect of the FCO’s decision pending the outcome of its appeal.

It is interesting to note the reasoning of the Federal Supreme Court in its press release (No. 080/2020), which is the only reasoning of the Court published so far:

“[…] it is – unlike emphasised by the Bundeskartellamt [FCO] in the contested decision – not decisive whether processing and using personal Facebook user data generated based on their online behaviour outside facebook.com and irrespective of whether they are logged in to Facebook complies with the rules of the General Data Protection Regulation.”

The abuse of dominant position by Facebook must, therefore, be answered – and affirmed – independently of the question of whether Facebook’s terms of use violate the provisions of the GDPR.

According to the decision of the Federal Supreme Court, the decisive factor is the lack of choice for Facebook users to opt out of intensive personalization when registering with the platform – this constitutes an abuse of Facebook’s dominant position. After all, if there was effective competition, Facebook would likely respond to users’ desire not to have their personal data combined and processed in this way. Users would then be able to switch to other alternatives, disclosing less data about themselves if that was their preference.

Any impairment of competition is therefore not necessarily only on the market for social networks, but also cannot be ruled out in the neighboring market for online advertising. This is a market which is of great importance for Facebook from a financial perspective. Facebook’s access to a considerably larger database also reinforces the already pronounced “lock-in effects”, so that there is no need to determine whether Facebook has a dominant position in that neighboring market as well.

What happens now?

The Higher Regional Court of Düsseldorf has not yet decided on Facebook’s appeal in the main proceedings. However, it can be expected that the FCO will proceed with the enforcement of its decision and prohibition order in the meantime.

In the main proceedings the Düsseldorf Cartel Senate may be guided by the recent decision of the Federal Supreme Court in the summary proceedings.  However, this is by no means certain given the Cartel Senate’s recent judicial practice. An added complexity is the possibility that the main proceedings could also be referred to the Court of Justice of the European Union for guidance. Relevant data protection authorities will also have a decision to make – the decision of the Federal Supreme Court increasing the pressure on them to take action.

It therefore remains to be seen whether the FCO will emerge as the final winner of the main proceedings in this case. However, the recent decision of the Federal Supreme Court provides some evidence to suggest that this is the most likely outcome at this stage.

Our take

This case highlights the intrinsic relationship between data protection and competition law.

It demonstrates how a company’s use and exploitation of personal data is a relevant parameter when determining market dominance. It also highlights that this is an area over which both data protection authorities and competition authorities can have competence.

It is likely that the decision will influence other abuse of dominance cases.  Therefore, companies that undertake large-scale data collection and processing should consider whether their activities: (i) comply with GDPR generally; and (ii) could constitute an abuse of a dominant market position under antitrust laws.  Otherwise, organizations could face sanctions under both regimes: the greater of €20 million or 4 per cent of annual global turnover from data protection authorities and up to 10 per cent of global group turnover from competition authorities. In addition to fines there are also the greater potential costs associated with multiple investigations, as well as other risks including reputational harm and possible damages actions.